Summary
@storybook/builder-webpack5@10.4.1 currently pulls fork-ts-checker-webpack-plugin@^9.1.0, which pulls chokidar@^4.0.1 (resolving to 4.0.3).
In environments with strict pnpm supply-chain policy (trustPolicy: no-downgrade), install fails with ERR_PNPM_TRUST_DOWNGRADE.
Error
[ERR_PNPM_TRUST_DOWNGRADE] 1 lockfile entries failed verification:
chokidar@4.0.3 High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)
Dependency path
@storybook/react-webpack5 -> @storybook/builder-webpack5 -> fork-ts-checker-webpack-plugin -> chokidar@^4.0.1
Upstream issue
Opened on fork-ts-checker:
TypeStrong/fork-ts-checker-webpack-plugin#895
Request
Could Storybook track this and bump/adjust once upstream provides a fix or guidance? This affects users adopting pnpm v11 supply-chain hardening defaults and strict trust policies.
Summary
@storybook/builder-webpack5@10.4.1currently pullsfork-ts-checker-webpack-plugin@^9.1.0, which pullschokidar@^4.0.1(resolving to4.0.3).In environments with strict pnpm supply-chain policy (
trustPolicy: no-downgrade), install fails withERR_PNPM_TRUST_DOWNGRADE.Error
Dependency path
@storybook/react-webpack5 -> @storybook/builder-webpack5 -> fork-ts-checker-webpack-plugin -> chokidar@^4.0.1Upstream issue
Opened on fork-ts-checker:
TypeStrong/fork-ts-checker-webpack-plugin#895
Request
Could Storybook track this and bump/adjust once upstream provides a fix or guidance? This affects users adopting pnpm v11 supply-chain hardening defaults and strict trust policies.